HTB: Challenge - Reminiscent
Reminiscent carves a malicious resume.pdf.lnk out of a Windows 7 memory dump with Volatility, then peels back two offset-read, base64-chained PowerShell stagers — the second an RC4-keyed Empire-style beacon — down to the flag.